iPhone Forensics Without iPhone using iTunes Backup
7 likes18,200 views
This document describes how to extract hidden data from iPhone backups stored in iTunes using a Python program. The 3 step process involves locating the iTunes backup files on the computer, extracting hidden data like Facebook friends, texts, photos using the iPhone Spy Python program, and then analyzing the extracted data.
iPhone Forensics Without iPhone using iTunes Backup
- 1. Free iPhone Forensics iPhone Spy Python Program -‐ no iPhone needed …remixed http://www.uptill3.com/static/iphone_forensics.pdf …
- 2. What can you spy? ! Call logs, SMS Messages, Contacts, Email, Calendar, Pictures, Web History ! Google Maps, GPS Tracking Info, Passwords, Facebook data
- 3. 3 easy steps • View pics, 1 2 3 • Find iPhones Facebook info hidden data • Extract data • iPhone Spy • Text • In iTunes Programs messages, call Backup history etc
- 4. Step 1
- 5. Locate the iTunes Backup files for iPhone
- 6. Find Backup data location iTunes backups of the iPhone are stored in the following directories: ! Windows XP: C:Documents and Settings(username) Application DataApple ComputerMobileSync Backup ! Windows Vista: C:Users(username)AppData RoamingApple ComputerMobileSyncBackup ! Mac OS X: /Users/(username)/Library/Application Support/MobileSync/Backup/
- 7. Look for these iPhone Backup files ! Info.plist – information about the iPhone, owner info ! Manifest.mdbd and Manifest.mdbx– iTunes 9.2 has changed Manifest.plist content and removed the .mdinfo files (and dropped the extension of .mddata files, however the 40 digit key is the same). The files database is now stored in a couple of file: Manifest.mbdb and Manifest.mbdx. The applications list remains in Manifest.plist. ! Manifest.plist – list of all files backed up, modification time and hash signature ! Status.plist – status of last sync
- 10. Contents Real filename Backup filename SMS / Text messages sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28! Contacts / address book AddressBook.sqlitedb adb8c77534444e97c31ff15924d50f3ed1fbd3b1! Contacts / address book AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442! Calendar Calendar.sqlitedb 14ee8cdc3e6e0220399ff210246e1c92b7df89a0! Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858! Notes notes.db 740b7eaf93d6ea5d305e88bb349c8e9643f48c3b! Notes notes.sqlite ca3bc056d4da0bbf88b5fb3be254f3b7147e639c! Call history call_history.db a49bfab36504be1bf563c1d1813b05efd6076717! Call history call_history.db ff1324e6b949111b2fb449ecddb50c89c3699a78! Call history call_history.db 2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca! Locations consolidated.db 4096c9ec676f2847dc283405900e284a7c815836!
- 11. Step 2
- 12. Now that you found iTunes Backups
- 14. iPhone Spy Python Program
- 15. You can search computer for iTunes Backups by selecting option 1)
- 16. Let’s spy iPhone Facebook Friends information from iTunes Backups
- 17. iPhone Spy Python program is extracting Facebook data from friends.db hidden in the iTunes Backup
- 18. Step 3
- 19. Let’s spy on the hidden Facebook data hidden in the iTunes Backup
- 20. Let’s spy on John Doe’s Facebook Data on this users iPhone
- 21. You can see John Doe’s picture by using this URL
- 22. Free iPhone Forensics in 3 easy steps Analyze with Spy Facebook, Find iTunes iPhone Spy SMS, Pics from Backup gadgets iPhone backup